Freely subscribe to our NEWSLETTER

This bulletin was written by Vigil@nce : http://vigilance.fr/offer

SYNTHESIS OF THE VULNERABILITY

An attacker can use two vulnerabilities related to cryptographic
features of NTP.org.

Impacted products: Cisco ASR, Cisco ACE, ASA, Cisco Catalyst, IOS
Cisco, IOS XE Cisco, IOS XR Cisco, Cisco IPS, Cisco Nexus, NX-OS,
Cisco Prime, Secure ACS, Cisco Router xx00 Series, Debian, Black
Diamond, ExtremeXOS, Ridgeline, Summit, BIG-IP Appliance, Fedora,
FreeBSD, HP-UX, MBS, Meinberg NTP Server, NTP.org, openSUSE,
Solaris, Slackware, Ubuntu

Severity: 2/4

Creation date: 07/04/2015

DESCRIPTION OF THE VULNERABILITY

Several vulnerabilities were announced in NTP.org.

An attacker can use a message without MAC (Message Authentication
Code), in order to bypass the authentication using a symmetric
key. [severity:2/4; 2779, CVE-2015-1798]

An attacker can spoof a packet between two servers paired with a
symmetric association, in order to trigger a denial of service.
[severity:2/4; 2781, CVE-2015-1799]

ACCESS TO THE COMPLETE VIGIL@NCE BULLETIN

http://vigilance.fr/vulnerability/NTP-org-two-vulnerabilities-of-Crypto-16548